ek-dev-licensing

Evaluate library licenses against permissive, copyleft, and non-commercial criteria.

Updated Jun 23, 2026

Search Tags:#dependencies #compliance #governance #licensing #risk-management #open-source

Ready to run

npx skills add https://github.com/thorwhalen/ek --skill ek-dev-licensing

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ek-dev-licensing
Source: https://github.com/thorwhalen/ek/tree/main/skills/ek-dev-licensing
Command: npx skills add https://github.com/thorwhalen/ek --skill ek-dev-licensing

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents legal and commercial risk by enforcing strict license compliance for all dependencies added to the ek framework, ensuring the core remains permissive and redistribution-ready.

Core Features & Use Cases

License Guardrails: Provides a clear decision procedure for classifying libraries as permissive, weak copyleft, or non-commercial.
Dependency Tiering: Maps libraries to specific extras to maintain a lean, MIT/BSD/Apache-2.0 core.
Risk Mitigation: Identifies scanner-invisible traps and provides audited replacements for GPL-licensed landmines like Levenshtein.

Quick Start

Consult the ek-dev-licensing skill to verify the license status and appropriate installation tier for a new library before adding it to the project.

Frequently Asked Questions about ek-dev-licensing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check open-source license compliance before adding a new dependency?▼

To check open-source license compliance, evaluate the new library against permissive, copyleft, and non-commercial criteria before installation. This process validates dependencies against a curated tier map and CI license gate requirements to prevent transitive contamination.

What is transitive license contamination and how does it affect commercial redistribution?▼

Transitive license contamination occurs when a permissive project pulls in copyleft or non-commercial dependencies, voiding commercial redistribution readiness. Evaluating library licenses against strict criteria prevents this risk by ensuring the core remains redistribution-ready.

How do I classify dependencies as permissive or copyleft for a framework?▼

Classify dependencies as permissive or copyleft by applying strict license guardrails that map libraries to specific extras. This maintains a lean MIT, BSD, or Apache-2.0 core while isolating non-permissive components.

Can I use GPL-licensed libraries in a permissive open-source project?▼

Using GPL-licensed libraries in a permissive project introduces legal risk and fails CI license gate requirements. You must identify scanner-invisible traps and replace them with audited alternatives to maintain commercial redistribution readiness.

Why does my CI pipeline fail when adding a new open-source dependency?▼

Your CI pipeline fails when adding a new dependency because it violates CI license gate requirements. The pipeline validates all new libraries against a curated tier map to enforce strict license compliance and block non-permissive additions.

What are the limitations of automated license scanners for dependency risk management?▼

Automated license scanners have limitations in detecting scanner-invisible traps like transitive GPL contamination. Manual evaluation against a curated tier map is required to identify these risks and find audited replacements for non-compliant libraries.